Oracle Commerce Platform CVE-2026-70954

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Commerce Platform 11.4.0 running the Dynamo Application Framework, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only prerequisite is network reachability of the vulnerable HTTP-facing Dynamo component. Limiting factors: exploitation is bounded to the affected 11.4.0 version, and deployments that are not internet-exposed (management interfaces segmented behind VPN/allowlist, or the platform reachable only internally) materially reduce real-world exposure even though the flaw itself needs no authentication.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is maximal on every metric that matters for prioritization: network-reachable, low complexity, no privileges, no user interaction, and total impact - meaning even a mid-sized municipal e-commerce team in mielec running an internet-facing storefront should treat this as urgent patching work. No EPSS score was provided, so exploitation probability cannot be quantified, and the CVE is not in CISA KEV, so there is no confirmed active exploitation; there is also no evidence of public POC. The Oracle-supplied tags ('Information Disclosure') conflict with the description and vector, which describe full 'takeover' with high integrity and availability impact - verify against the Oracle advisory, as the tag appears to understate the actual impact. Net assessment: this is a genuine top-priority vulnerability on severity and exploitability grounds despite the absence of KEV/EPSS/POC signals, because unauthenticated full-takeover flaws in internet-facing commerce platforms are prime targets once details emerge.

An attacker who can reach the Oracle Commerce storefront or management application over HTTP sends a single crafted request to the vulnerable Dynamo Application Framework endpoint, requiring no credentials and no user interaction. The request triggers the flaw and yields full control of the platform, enabling theft of customer and order data, tampering with the storefront, and disruption of service. No public exploit is identified at time of analysis, but the low attack complexity makes reliable exploitation likely once technical details are reverse-engineered from the patch.